82b9e2a2ba3beb30b1ac58cdea177c9a69aa83c6f6e969c66a12dc4e67bce70e

General

Target

RFQ PETROIL BID INVITATION EOI - 16674.01 4KPET.exe
Size

739KB
MD5

0651a05d2350a93f9f1ff6400d7db55d
SHA1

4548e1d49873626ac6eee581126318b17024feb5
SHA256

a5be206861bab4850f3022243ae51161423cc8f8a12aed99f9f55f04a774df73
SHA512

9340e004fab5479e90acacfb6260ba9681a6a60f6fd76c230270eeecd6d3f42f0fa9ea33ac82bd36b474b5066cc763d54e10403648149dcecd6e8486a13b1f51
SSDEEP

12288:nYRxA4Y5lyA/BxSPCyWqLoPZGDI+ef31hJLYZsMJB2RTMRutAbW5KNhc:YRBLhDM9hJXuBwgRut/5KN

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RFQ PETROIL BID INVITATION EOI - 16674.01 4KPET.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1724	RFQ PETROIL BID INVITATION EOI - 16674.01 4KPET.exe
1724	RFQ PETROIL BID INVITATION EOI - 16674.01 4KPET.exe
1724	RFQ PETROIL BID INVITATION EOI - 16674.01 4KPET.exe
1724	RFQ PETROIL BID INVITATION EOI - 16674.01 4KPET.exe
1724	RFQ PETROIL BID INVITATION EOI - 16674.01 4KPET.exe
1724	RFQ PETROIL BID INVITATION EOI - 16674.01 4KPET.exe
1724	RFQ PETROIL BID INVITATION EOI - 16674.01 4KPET.exe
1724	RFQ PETROIL BID INVITATION EOI - 16674.01 4KPET.exe
1724	RFQ PETROIL BID INVITATION EOI - 16674.01 4KPET.exe
1724	RFQ PETROIL BID INVITATION EOI - 16674.01 4KPET.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1724	RFQ PETROIL BID INVITATION EOI - 16674.01 4KPET.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 1096	1724	RFQ PETROIL BID INVITATION EOI - 16674.01 4KPET.exe	31
PID 1724 wrote to memory of 1096	1724	RFQ PETROIL BID INVITATION EOI - 16674.01 4KPET.exe	31
PID 1724 wrote to memory of 1096	1724	RFQ PETROIL BID INVITATION EOI - 16674.01 4KPET.exe	31
PID 1724 wrote to memory of 1096	1724	RFQ PETROIL BID INVITATION EOI - 16674.01 4KPET.exe	31
PID 1724 wrote to memory of 2144	1724	RFQ PETROIL BID INVITATION EOI - 16674.01 4KPET.exe	32
PID 1724 wrote to memory of 2144	1724	RFQ PETROIL BID INVITATION EOI - 16674.01 4KPET.exe	32
PID 1724 wrote to memory of 2144	1724	RFQ PETROIL BID INVITATION EOI - 16674.01 4KPET.exe	32
PID 1724 wrote to memory of 2144	1724	RFQ PETROIL BID INVITATION EOI - 16674.01 4KPET.exe	32
PID 1724 wrote to memory of 2184	1724	RFQ PETROIL BID INVITATION EOI - 16674.01 4KPET.exe	33
PID 1724 wrote to memory of 2184	1724	RFQ PETROIL BID INVITATION EOI - 16674.01 4KPET.exe	33
PID 1724 wrote to memory of 2184	1724	RFQ PETROIL BID INVITATION EOI - 16674.01 4KPET.exe	33
PID 1724 wrote to memory of 2184	1724	RFQ PETROIL BID INVITATION EOI - 16674.01 4KPET.exe	33
PID 1724 wrote to memory of 2932	1724	RFQ PETROIL BID INVITATION EOI - 16674.01 4KPET.exe	34
PID 1724 wrote to memory of 2932	1724	RFQ PETROIL BID INVITATION EOI - 16674.01 4KPET.exe	34
PID 1724 wrote to memory of 2932	1724	RFQ PETROIL BID INVITATION EOI - 16674.01 4KPET.exe	34
PID 1724 wrote to memory of 2932	1724	RFQ PETROIL BID INVITATION EOI - 16674.01 4KPET.exe	34
PID 1724 wrote to memory of 2148	1724	RFQ PETROIL BID INVITATION EOI - 16674.01 4KPET.exe	35
PID 1724 wrote to memory of 2148	1724	RFQ PETROIL BID INVITATION EOI - 16674.01 4KPET.exe	35
PID 1724 wrote to memory of 2148	1724	RFQ PETROIL BID INVITATION EOI - 16674.01 4KPET.exe	35
PID 1724 wrote to memory of 2148	1724	RFQ PETROIL BID INVITATION EOI - 16674.01 4KPET.exe	35

C:\Users\Admin\AppData\Local\Temp\RFQ PETROIL BID INVITATION EOI - 16674.01 4KPET.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ PETROIL BID INVITATION EOI - 16674.01 4KPET.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Users\Admin\AppData\Local\Temp\RFQ PETROIL BID INVITATION EOI - 16674.01 4KPET.exe
  "C:\Users\Admin\AppData\Local\Temp\RFQ PETROIL BID INVITATION EOI - 16674.01 4KPET.exe"
  2⤵
  PID:1096
- C:\Users\Admin\AppData\Local\Temp\RFQ PETROIL BID INVITATION EOI - 16674.01 4KPET.exe
  "C:\Users\Admin\AppData\Local\Temp\RFQ PETROIL BID INVITATION EOI - 16674.01 4KPET.exe"
  2⤵
  PID:2144
- C:\Users\Admin\AppData\Local\Temp\RFQ PETROIL BID INVITATION EOI - 16674.01 4KPET.exe
  "C:\Users\Admin\AppData\Local\Temp\RFQ PETROIL BID INVITATION EOI - 16674.01 4KPET.exe"
  2⤵
  PID:2184
- C:\Users\Admin\AppData\Local\Temp\RFQ PETROIL BID INVITATION EOI - 16674.01 4KPET.exe
  "C:\Users\Admin\AppData\Local\Temp\RFQ PETROIL BID INVITATION EOI - 16674.01 4KPET.exe"
  2⤵
  PID:2932
- C:\Users\Admin\AppData\Local\Temp\RFQ PETROIL BID INVITATION EOI - 16674.01 4KPET.exe
  "C:\Users\Admin\AppData\Local\Temp\RFQ PETROIL BID INVITATION EOI - 16674.01 4KPET.exe"
  2⤵
  PID:2148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1724-0-0x0000000073E9E000-0x0000000073E9F000-memory.dmp

Filesize
4KB

Download
memory/1724-1-0x0000000000390000-0x0000000000450000-memory.dmp

Filesize
768KB

Download
memory/1724-2-0x0000000073E90000-0x000000007457E000-memory.dmp

Filesize
6.9MB

Download
memory/1724-3-0x0000000000510000-0x000000000052A000-memory.dmp

Filesize
104KB

Download
memory/1724-4-0x0000000073E9E000-0x0000000073E9F000-memory.dmp

Filesize
4KB

Download
memory/1724-5-0x0000000073E90000-0x000000007457E000-memory.dmp

Filesize
6.9MB

Download
memory/1724-6-0x00000000051B0000-0x000000000523E000-memory.dmp

Filesize
568KB

Download
memory/1724-7-0x0000000073E90000-0x000000007457E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing